better deploys

.gitea/workflows/deploy.yml

@@ -94,6 +94,12 @@ jobs:
           GEMINI_API_KEY: ${{ secrets.VITE_GOOGLE_GENAI_API_KEY }}
 
         run: npm run test:coverage
+        # Fail-fast check to ensure secrets are configured in Gitea for testing.
+        if [ -z "$DB_HOST" ] || [ -z "$DB_USER" ] || [ -z "$DB_PASSWORD" ] || [ -z "$DB_DATABASE" ] || [ -z "$GEMINI_API_KEY" ]; then
+          echo "ERROR: One or more test secrets (DB_HOST, DB_USER, DB_PASSWORD, DB_DATABASE, VITE_GOOGLE_GENAI_API_KEY) are not set."
+          exit 1
+        fi
+
         continue-on-error: true # Allows the workflow to proceed even if tests fail.
 
       - name: Archive Code Coverage Report
@@ -112,6 +118,12 @@ jobs:
           DB_PASSWORD: ${{ secrets.DB_PASSWORD }}
           DB_DATABASE: ${{ secrets.DB_DATABASE_PROD }} # Assumes a secret for the production DB name.
         run: |
+          # Fail-fast check to ensure secrets are configured in Gitea.
+          if [ -z "$DB_HOST" ] || [ -z "$DB_USER" ] || [ -z "$DB_PASSWORD" ] || [ -z "$DB_DATABASE" ]; then
+            echo "ERROR: One or more production database secrets (DB_HOST, DB_USER, DB_PASSWORD, DB_DATABASE_PROD) are not set in Gitea repository settings."
+            exit 1
+          fi
+
           echo "--- Checking for schema changes ---"
           # Calculate the hash of the current schema file in the repository.
           # We normalize line endings to ensure the hash is consistent across different OS environments.
@@ -144,6 +156,12 @@ jobs:
         # This maps the Gitea secret to the environment variable the application expects.
         # We also generate and inject the application version, commit URL, and commit message.
         run: |
+          # Fail-fast check for the build-time secret.
+          if [ -z "${{ secrets.VITE_GOOGLE_GENAI_API_KEY }}" ]; then
+            echo "ERROR: The VITE_GOOGLE_GENAI_API_KEY secret is not set."
+            exit 1
+          fi
+
           GITEA_SERVER_URL="https://gitea.projectium.com" # Your Gitea instance URL
           COMMIT_MESSAGE=$(git log -1 --pretty=%s)
           VITE_APP_VERSION="$(date +'%Y%m%d-%H%M'):$(git rev-parse --short HEAD)" \
@@ -178,6 +196,12 @@ jobs:
           DB_PASSWORD: ${{ secrets.DB_PASSWORD }}
           DB_DATABASE: ${{ secrets.DB_DATABASE_PROD }}
         run: |
+          # Fail-fast check to ensure secrets are configured in Gitea.
+          if [ -z "$DB_HOST" ] || [ -z "$DB_USER" ] || [ -z "$DB_PASSWORD" ] || [ -z "$DB_DATABASE" ]; then
+            echo "ERROR: One or more production database secrets (DB_HOST, DB_USER, DB_PASSWORD, DB_DATABASE_PROD) are not set in Gitea repository settings."
+            exit 1
+          fi
+
           echo "Installing production dependencies and restarting server..."
           cd /var/www/flyer-crawler.projectium.com
           npm install --omit=dev # Install only production dependencies

.gitea/workflows/manual-db-reset.yml

@@ -32,6 +32,15 @@ jobs:
       - name: Checkout Code
         uses: actions/checkout@v3
 
+      - name: Validate Secrets
+        run: |
+          # Fail-fast check to ensure secrets are configured in Gitea.
+          if [ -z "$DB_HOST" ] || [ -z "$DB_USER" ] || [ -z "$DB_PASSWORD" ] || [ -z "$DB_DATABASE" ]; then
+            echo "ERROR: One or more production database secrets (DB_HOST, DB_USER, DB_PASSWORD, DB_DATABASE_PROD) are not set in Gitea repository settings."
+            exit 1
+          fi
+          echo "✅ All required database secrets are present."
+
       - name: Verify Confirmation Phrase
         run: |
           if [ "${{ gitea.event.inputs.confirmation }}" != "reset-production-db" ]; then